Examkin

Soru

Zorluk: ZorApp Registrations and Service Principals

You are developing a secure Web API named InventoryAPI and registering it in Microsoft Entra ID. You need to expose two distinct permission sets for client applications that will consume this API:

1. A permission set for automated backend daemon services that run without user interaction.
2. A permission set for user-facing client applications where permissions are delegated on behalf of the signed-in user.

You need to configure the application registration manifest for InventoryAPI to support these requirements.

Which configuration should you implement in the manifest?

  1. A
    Define delegated permissions in the oauth2PermissionScopes array with allowedMemberTypes set to ["Application"] for the daemon services, and define app roles in the appRoles array for the user-interactive applications.
  2. B
    Define a system-assigned managed identity for the daemon services in the identity block, and define app roles in the appRoles array with allowedMemberTypes set to ["User"] for the user-interactive applications.
  3. Define app roles in the appRoles array with allowedMemberTypes set to ["Application"] for the daemon services, and define delegated scopes in the oauth2PermissionScopes array for the user-interactive applications.Cevap
  4. D
    Define app roles in the appRoles array with allowedMemberTypes set to ["DirectoryRole"] for the daemon services, and define app roles in the appRoles array with allowedMemberTypes set to ["Delegated"] for the user-interactive applications.

Cevap

Define app roles in the appRoles array with allowedMemberTypes set to ["Application"] for the daemon services, and define delegated scopes in the oauth2PermissionScopes array for the user-interactive applications.
The correct option correctly states that application permissions (which daemon applications require because they authenticate as their own identity) must be defined as app roles within the appRoles array with the allowedMemberTypes property containing "Application". Meanwhile, delegated permissions (which user-facing client applications require to act on behalf of a signed-in user) must be defined as scopes within the oauth2PermissionScopes array.

Adım Adım Çözüm

1
Analyze client type requirements for the API.
Backend daemon applications require Application permissions (as they run without a signed-in user). User-facing applications require Delegated permissions (scopes) since they act on behalf of a signed-in user.
This establishes the appropriate Entra ID authorization model needed for each consumer type.
2
Map the permission types to their respective Microsoft Entra ID manifest elements.
Application permissions are represented by appRoles where allowedMemberTypes includes "Application". Delegated permissions are represented by OAuth 2.0 permission scopes defined in the oauth2PermissionScopes array.
This determines the syntax and structure needed in the InventoryAPI registration manifest.
3
Validate the valid values for manifest properties.
allowedMemberTypes only accepts "User", "Application", or both. oauth2PermissionScopes defines scopes for delegated user access.
This ensures the manifest configuration is syntactically valid and aligns with Microsoft Entra ID schema constraints.

Anahtar Kavram

Exposing delegated permissions (scopes) vs application permissions (app roles) in a Microsoft Entra ID App Registration manifest
Bu soruyu puanla

Konular

App Registrations and Service Principals

Bu konudan daha fazla soru